Free tool · about 3 minutes
Where does CUI go in your company? Sketch your CMMC boundary.
The CMMC Level 2 rule sorts every system into one of five asset categories, and the category decides how it's assessed. Say what controlled unclassified information (CUI) does in each kind of system you run, and the sketch sorts and draws your boundary as you answer.
Your answers stay in your browser. Generic labels only: no system names. Nothing is sent unless you ask for the full sketch and the PDF.
Where does CUI go?
For each kind of system, pick what controlled unclassified information (CUI) does there. Skip any you don't have.
Your answers stay in this browser tab. Nothing is sent unless you ask for the full sketch below.
FIG. — YOUR BOUNDARY SKETCH · IN SCOPE 0 · OUT 0 · TO SETTLE 0
CMMC assessment scope · sketch
Answer a few rows and your boundary draws here.
The five asset categories · 32 CFR 170.19 · as of Nov 5, 2026
How the CMMC Level 2 rule sorts your systems
In plain words, from Table 3 of the rule. Any asset that fits an in-scope category can't be treated as out of scope.
- CUI Assets
- Process, store or transmit controlled unclassified information (CUI). Assessed against all Level 2 security requirements.
- Security Protection Assets
- Provide security functions or capabilities for the systems in scope, whether or not they hold CUI themselves. Assessed against the Level 2 requirements relevant to the capabilities they provide.
- Contractor Risk Managed Assets
- Could process, store or transmit CUI, but aren't intended to because of your security policies, procedures and practices. They don't have to be separated from CUI assets. The assessor reviews your SSP. If it's well documented they aren't assessed further, though the assessor can run a limited check if your documentation raises questions.
- Specialized Assets
- Can process, store or transmit CUI but can't be fully secured: IoT and industrial IoT devices, operational technology, government-furnished equipment, restricted information systems and test equipment. The assessor reviews your SSP; they aren't assessed against the other security requirements.
- Out-of-Scope Assets
- Can't process, store or transmit CUI and don't provide security protections for CUI assets, for example because they're physically or logically separated. Not assessed.
Questions
CMMC scoping and the CUI boundary, answered
What is the CUI boundary for CMMC Level 2?
- It's the set of systems a Level 2 assessment looks at: the assets that process, store or transmit controlled unclassified information (CUI), the assets that protect them, and the assets that could hold CUI but are kept from it by your policies. The CMMC rule (32 CFR 170.19) sorts assets into five categories, and each category is treated differently in an assessment.
What are the CMMC Level 2 asset categories?
- CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets. CUI Assets are assessed against all Level 2 requirements; Security Protection Assets against the requirements relevant to what they do; Contractor Risk Managed Assets and Specialized Assets are documented in your System Security Plan; Out-of-Scope Assets aren't assessed, but you must be able to justify why they can't handle CUI.
Is my MSP or my security tooling in scope?
- It can be. Tools that provide security functions for the systems in scope are Security Protection Assets even if they never hold CUI. A provider that handles only security data, such as logs, configuration data or passwords to your environment, is in your assessment scope and assessed as a Security Protection Asset. A provider that handles CUI is in scope as part of your assessment, and a cloud provider that holds CUI must meet the FedRAMP requirements in DFARS 252.204-7012.
Can shop-floor machines or test equipment be left out?
- Not simply by leaving them out. The rule treats IoT and industrial IoT devices, operational technology, government-furnished equipment, restricted information systems and test equipment that can handle CUI as Specialized Assets: you document them in your SSP and show they're managed under your risk-based security policies, and the assessor reviews the SSP rather than assessing them against the other requirements.
Is this sketch my official scope?
- No. It's a starting point drawn from your own answers about generic kinds of system. Your boundary is confirmed against your actual systems, data flows and contracts, which is the first thing the Level 2 Readiness Assessment does. It isn't an assessment or an SPRS score.
What happens to my answers?
- They stay in your browser tab and the sketch is drawn there. The tool never asks for system names. If you ask for the full sketch, ForgePoint keeps your name, work email, company, platform, the suggested next step and the date in its CRM, not the sketch itself, and the PDF is drawn on request and not kept.
Where it leads
Level 2 Readiness Assessment
The Assessment confirms your boundary with you, then checks all 110 requirements against what's inside it. See the Level 2 Readiness Assessment → Not sure where you stand overall? Take the Level 2 Self-Check →